Use array:filter() to filter elements within an array field.

array:filter(array="agents[]", function={bname=/\//}, var="bname")

Input: The subquery processes each element of the agents[] array.

Output: The subquery returns true or false for each element. Only elements where the subquery returns true are kept in the filtered array.

Use an array of subqueries in groupBy() to perform multiple aggregations on grouped events.

groupBy(userid, function=[{statuscode = 200
| count(as=status200)},{statuscode = 500
| count(as=status500)}])
| test(status500 > status200)

Input: Each subquery processes the events in each group defined by userid.

Output: Each subquery performs an aggregation and returns a field (status200 or status500) that is added to the group's result event.

Use join() to combine events from the primary query with events from an independent subquery that retrieves data directly from a repository.

#repo=main
| join({#repo=lookup
| groupBy(userid, function=count(as=loginCount))}, field=userid, key=userid)

Input: The subquery runs independently and retrieves events directly from the lookup repository, not from the primary query events.

Output: The subquery produces aggregated results that are joined with the primary query events based on the userid field.

Use selfJoinFilter() to filter events based on conditions applied to the same event set.

selfJoinFilter(field=userid, where={count() > 5})

Input: The subquery processes events from the primary query, grouped by userid.

Output: The subquery filters groups. Only events from groups where the count exceeds 5 are kept in the result set.